[Snort-users] Another question

Tommy Tsilalis Thomas.Tsilalis at ...5827...
Sat May 11 20:07:29 EDT 2002


This is another Snort output.

[**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 192.168.0.2 (THRESHOLD 4
connections exceeded in 0 seconds) [**]

I suppose that spp_portscan is the Snort function which identifies or checks
for portscans.
What does the following mean?
[100:1:1]

Thanks again.


Thomas Tsilalis





More information about the Snort-users mailing list